# CVE-2026-54901: ohler55 Oj Use-After-Free in Oj::Parser GC marking

Source: https://junglewise.ai/threats/cve-2026-54901-ohler55-oj-use-after-free-in-oj-parser-gc-marking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-54901 · Severity: high · CVSS 4 · Published 2026-07-01

Oj (Optimized JSON) is a high-performance Ruby library used for processing JSON data. A flaw in how the library manages memory during data cleanup (garbage collection) can cause the application to crash when processing specific JSON inputs. This could lead to a denial-of-service, impacting the availability of Ruby-based web applications or services that rely on this library for data parsing.

Technologies: [oj (RubyGems)](https://junglewise.ai/threats/technologies/oj). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54901 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54901 being exploited in the wild.

**How severe is CVE-2026-54901?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.

**Is there a fix for CVE-2026-54901?** Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54901 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54901?** Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oj (RubyGems): upgrade to 3.17.3 or later

  ```sh
  bundle update oj
  ```


## Technical details

A Use-After-Free (UAF) vulnerability exists in Oj::Parser within the 'usual' mode due to improper garbage collection (GC) marking. The `parser_mark` function in `ext/oj/parser.c` fails to mark `array_class` and `hash_class` references. If a GC cycle occurs after these classes are assigned to the parser but before a parse operation begins, the Ruby GC reclaims the class objects. Subsequent calls to `rb_funcallv` within `usual.c` then dereference these dangling pointers, resulting in a segmentation fault. This issue affects all versions prior to 3.17.2 and can be triggered if an attacker can influence the parser configuration or timing.

## Affected products

- ohler55 oj < 3.17.2

## Identifiers

- CVE-2026-54901
- GHSA-vwm4-62gf-x745

## Timeline

- 2026-06-16: advisory: GitHub Security Advisory published by maintainer
- 2026-06-30: patched: Fix released in version 3.17.2
- 2026-07-01: disclosed: CVE-2026-54901 published to NVD

## References

- [https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745](https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745)

## Related threats

- [ohler55 Oj integer overflow in Oj.load heap corruption](https://junglewise.ai/threats/cve-2026-54903-ohler55-oj-integer-overflow-in-oj-load-heap-corruption)
- [ohler55 Oj use-after-free in Oj::Parser SAJ mode](https://junglewise.ai/threats/cve-2026-54902-ohler55-oj-use-after-free-in-oj-parser-saj-mode)
- [ohler55 Oj heap corruption in Oj::Parser via integer truncation](https://junglewise.ai/threats/cve-2026-54900-ohler55-oj-heap-corruption-in-oj-parser-via-integer-truncation)
- [ohler55 Oj heap use-after-free in Oj::Parser symbol_keys toggle](https://junglewise.ai/threats/cve-2026-54899-ohler55-oj-heap-use-after-free-in-oj-parser-symbol-keys-toggle)
- [ohler55 Oj heap use-after-free in Oj::Parser#parse](https://junglewise.ai/threats/cve-2026-54898-ohler55-oj-heap-use-after-free-in-oj-parser-parse)